Hacker News new | ask | show | jobs
by hynek 4887 days ago
Absolutely. But since we still have to support SSLv3 from 1996, I wouldn’t hold my breath. :(
2 comments

Yeah. The outlook is not that great, and RC4 will definitely be better than CBC for those legacy systems in light of this discovery (http://www.isg.rhul.ac.uk/tls/). At least the browsers are actively working on supporting the latest TLS and modes.
Yes, the discovery of Lucky13 and the following helplessness by many not-really-ops-but-doing-it-anyway people were the motivation to write that article in the first place. To get a minimal baseline security out there. Those who know better, will do better. There’s enough additional links to get hooked up. Can’t do more. :)
"Lucky 13" isn't exactly an ops crisis. You probably don't need to stay up late patching this one, unless you're using DTLS.
Oh certainly not a crisis – especially since it didn't bring new vectors to the table. I just saw many “what now!?”s in my timelines and figured I better give them a solid good-enough solution that just works before they do something stupid.
Do we really? What browsers don't support at least TLS 1.0? Or is it other user agents?
It very much depends on your target audience.

We’re in the web hosting business and whenever we try to be a bit more progressive, people start yelling at us that their IE 4-using customers in rural Mongolia can’t SSL-surf their shop. When it comes to mail, IIRC some business phones were behind too.

OTOH iOS 6 support TLS 1.2, so if you’re just building a REST API for your own apps, you can go wild.